[PATCH] spufs: check for proper file pointer in sys_spu_run

Only checking for SPUFS_MAGIC is not reliable, because
it might not be unique in theory. Worse than that,
we accidentally allow spu_run to be performed on
any file in spufs, not just those returned from
spu_create as intended.

Noticed by Al Viro.

Signed-off-by: Arnd Bergmann <arndb@de.ibm.com>
Signed-off-by: Paul Mackerras <paulus@samba.org>

diff --git a/arch/powerpc/platforms/cell/spufs/inode.c b/arch/powerpc/platforms/cell/spufs/inode.c
index 45944012b06aa57dafe8aea2ee158457686da738..e314f18eccdd07b9ea69760c5f3c872cf1f5ad46 100644 (file)
--- a/arch/powerpc/platforms/cell/spufs/inode.c
+++ b/arch/powerpc/platforms/cell/spufs/inode.c
@@ -212,7 +212,7 @@ struct inode_operations spufs_dir_inode_operations = {
        .lookup = simple_lookup,
 };
 
-struct file_operations spufs_autodelete_dir_operations = {
+struct file_operations spufs_context_fops = {
        .open           = dcache_dir_open,
        .release        = spufs_dir_close,
        .llseek         = dcache_dir_lseek,
@@ -301,7 +301,7 @@ spufs_create_thread(struct nameidata *nd, const char *name,
                put_unused_fd(ret);
                ret = PTR_ERR(filp);
        } else {
-               filp->f_op = &spufs_autodelete_dir_operations;
+               filp->f_op = &spufs_context_fops;
                fd_install(ret, filp);
        }
 

diff --git a/arch/powerpc/platforms/cell/spufs/spufs.h b/arch/powerpc/platforms/cell/spufs/spufs.h
index 17cae5e5fdf51991d8ace480e59152260d3404ee..420953b5888183f147ff7108018734b68322fe68 100644 (file)
--- a/arch/powerpc/platforms/cell/spufs/spufs.h
+++ b/arch/powerpc/platforms/cell/spufs/spufs.h
@@ -103,6 +103,7 @@ long spufs_run_spu(struct file *file,
                   struct spu_context *ctx, u32 *npc, u32 *status);
 long spufs_create_thread(struct nameidata *nd, const char *name,
                         unsigned int flags, mode_t mode);
+extern struct file_operations spufs_context_fops;
 
 /* context management */
 struct spu_context * alloc_spu_context(struct address_space *local_store);

diff --git a/arch/powerpc/platforms/cell/spufs/syscalls.c b/arch/powerpc/platforms/cell/spufs/syscalls.c
index 17a2b51c94bc3c0ad7308e7df494c1a1bd221fa4..0c2896ac9518008dcfa04f5b3f7de58bf88f418e 100644 (file)
--- a/arch/powerpc/platforms/cell/spufs/syscalls.c
+++ b/arch/powerpc/platforms/cell/spufs/syscalls.c
@@ -39,8 +39,9 @@ long do_spu_run(struct file *filp, __u32 __user *unpc, __u32 __user *ustatus)
        if (get_user(npc, unpc) || get_user(status, ustatus))
                goto out;
 
+       /* check if this file was created by spu_create */
        ret = -EINVAL;
-       if (filp->f_vfsmnt->mnt_sb->s_magic != SPUFS_MAGIC)
+       if (filp->f_op != &spufs_context_fops)
                goto out;
 
        i = SPUFS_I(filp->f_dentry->d_inode);